S00-003: Evaluate Stanza with verified SCRAM and bounded WSS ingress

Changes: Propose the pinned XMPP library decision and add an isolated browser-built selection spike combining reviewed public SASL, SHA-512 and parser seams. Exercise TLS/xmpp handshake, strongest compatible non-PLUS authentication, rejected unsafe paths and extension mappings; document duplicate-body export projection and remaining limits. Preserve dependency notices, evidence and QA handoff.
Validation: Clean-cache pinned npm ci succeeded; npm test passed 112 checks; check-dependencies.py verified 51 locked entries, 26 installed packages and 340 unchanged vendor files; make check passed 72 tooling tests. No actual browser runtime, independent full XMPP server/client or production encryption/release readiness claim.

Task: S00-003
Agent: auto-protocol-f474114f0168
Role: protocol
Action: claim
Status: review

Task title: Проверить XMPP WSS/auth библиотеку

state/handoffs/S00-003.md

@@ -1,27 +1,38 @@
-# S00-003 blocked handoff
+# S00-003 handoff for independent QA review
 
-Executor: auto-protocol-59f4d359b339, protocol, 2026-10-15.
-Outcome remains library selection with WSS/auth/parser/extension spike.
+Executor: auto-protocol-f474114f0168 (protocol), 2026-10-15.
+No blocker. Proposed Stanza 12.22.1 selection and combined isolated spike at
+experiments/0002-xmpp-library/selection-spike; ADR docs/decisions/0002-xmpp-library.md.
 
-Accepted prerequisites S00-001/002/017/018/019 were read. The SHA-512 public
-mechanism composition is now independently accepted; the earlier crypto blocker
-is resolved. Their suites were not rerun in this environment. Parent candidate
-remains unselected and selection ADR absent.
+Actual result: clean-cache locked install on accepted Linux Node24.21.0/npm11.19.0,
+browser bundle and 112 tests pass. Real synthetic loopback WSS TLS/xmpp handshake,
+fixed SCRAM512/256/1 proofs/finals/restart, strongest compatible non-PLUS policy,
+PLUS/plaintext rejection, untrusted certificate/plain endpoint rejection,
+bounded XML over WSS and registry extension checks. 51 locked/26 installed
+package checks and notices, 340 unmodified vendor files, reviewed parser/SHA512
+source reuse verified. make check: 72 tooling tests passed, exit 0.
+Evidence: state/evidence/S00-003-auto-protocol-f474114f0168.md.
 
-Current blocker: accepted Node 24.21.0/npm 11.19.0 and installed Stanza are not
-available in this Linux session (host tools 24.1.0/11.3.0; parent node_modules
-absent). Official checksum retrieval over configured HTTPS fails with curl exit
-5, unresolved proxy. See state/evidence/S00-003-auto-protocol-59f4d359b339.md for exact reproduction.
+QA next: inspect actual diff/executor message, proposed ADR and README. Repeat
+clean npm ci with a new cache, npm test, check-dependencies.py and relevant
+foundation check using reviewed runtime currently at
+/tmp/luma-S00-026-j1pmys7w/node-v24.21.0-linux-x64/bin.
+Temporary tools may expire; environment-access probe can recreate authentic
+runtime/vendor comparison graph. Do not change accepted pins or security policy.
+Verify browser graph, public seams, fail-closed effects, notices and limitations.
 
-Next input: external environment owner must restore approved HTTPS access to
-nodejs.org and registry.npmjs.org or provide authentic, checksum/integrity-
-verifiable pinned Linux toolchain and locked package artifacts through an
-approved local path. Do not change stack pins, bypass proxy policy/TLS, fabricate
-engine metadata or reuse a macOS binary. Fresh remediation executor must verify
-exact runtime and lock installation, with independent review before parent
-returns to a new executor. Supply no credentials in committed evidence.
+Raw imported messages carry selected body plus language bodies; passing both to
+export duplicates text in this version. Permanent regression records it. MAM
+fixture explicitly exports the language collection only; future adapters must
+construct outbound shapes. Upload's actual field is httpUpload.download.
+Initial harness failures and corrections are recorded, not counted as passed.
 
-No source changes or installs/build/tests/browser/WSS execution occurred. Browser
-binaries are present but not exercised. No make check, complete SASL policy,
-extension roundtrip, independent interoperability or selection claimed.
-Reporter exits after escalation; no resolver work, unblock or new agent launch.
+Limits: browser-built backend runs in Node, no actual browser or independent
+full XMPP server/client; scripted peer uses accepted fixed transcripts. No OMEMO
+crypto/OMEMO2 wire validation, full XEP semantics or release readiness. Fixture
+certificate trusted only through injected socket with validation enabled; no
+system trust changes/keys committed. No real binding/fallback. Inherited strict
+SCRAM layout/timeout/timing, minimal transport/lifecycle and aggregate queue
+limits remain. Source changes are only current task paths plus workflow metadata.
+ADR stays proposed until separate QA acceptance. Coordinator alone commits and
+launches new process; executor exits immediately after submit.